apiVersion: security.istio.io/v1
kind: PeerAuthentication
metadata:
  name: default
  namespace: prod-apps
spec:
  mtls:
    mode: STRICT
---
apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
  name: allow-known-callers
  namespace: prod-apps
spec:
  selector:
    matchLabels:
      app: payments-api
  rules:
  - from:
    - source:
        principals:
        - cluster.local/ns/prod-orders/sa/orders-api
        - cluster.local/ns/prod-billing/sa/billing-api
